SECRET 


b 6 From: 

b7C To:" 

(S)- h1 S : 

D i RECO 


CTD) (FBI) 

ynnHaw li ilw m annca-ia AM 

l OGCUFBn 

FW: Overcollection of Records RELATED TO ISSUED NSLs 


EX. 

R 


b6 

b7C 

b2 


NSL embedded below for review per your request. 


Supervisory Special Agent 
CTD/ITOS l/CONUS II 

I I 

t^esk) 
ager) 


b6 
b7C 
b2 

b7E 

\ «-• 1 


— Original Mess 

From: 

Sent: 

To: 

Cc: 

Subject: 




a 


(OGA) 


Monday, July 03, 2006 8:55 AM 
l irrrm (FBI) 

I | (CTD) (FBI] 


lCFBI); 


RE: Overcollection of Records RELATED TO ISSUED NSLs 
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I am attaching the NSL that i submitted 

overcoliection of information. I asked for records from[ 


an d ended up getting an 
t hrough the 


(S) 

bl 

b7D 


present and got records that were available from the date of inception through the 
"present . 11 I had written two ECs that included information that was listed in the 
"overcoliection." I already charged one of them out, because when I submitted a 
new NSL for all available records from the date of inception through the present 
some of the data had changed. I removed any data that was not included with the 
NEW results. Regarding the second EC I wrote using information from the 
"overcollection" - if the data is the same can i keep my original EC in ACS or should 
i charge it out? Right now it appear s that times that some of the e-mails were sent 
may v ary, based on it being reported r ~~ I 

I I I didn't know if this second serial should be charged out since it was dated 
prior to the NEW results being received. Or if it can stand as it is. 
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One more necessary evil, but it could be of benefit. 


NSLB wouid like to get copies of the NSLs you've issued that resulted in the Provider sending 
more than what was requested We would like to check the specific language to see if there is 
anything in the body that would cover the extra material they gave If not, as in the past "over 
collections, " they will need to be reported as "potential lOBs" even If you've Issued a new NSL 
for that info. 

ere have no way of know which 
ones resulted in the Provider errors. If you could attach all the related ones to a reply e-maii 
with some background explanation related to each we will review them. Let's 
boiler plate language covers you regardless of your specific listed time frames, 
you know what. Any questions, let me know. Thanks. 
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Supervisory Special Agent 
CTD/ITOS l/CONUS II 
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I just w anted to inform you about an overcollection of records ! 

| l am working on getting the situation corrected at this time. There 
were a couple of instances within the past few months and even though I 
didn’t ask for these records I need to report it to the IOB. 


The first instance 

n 

I 

provided 

records! 

II did not realize 

that it was a biq deal to use the "extra"records. 1 1 

I 

1 No NSLs 


were issued off the "extra" records. | 


|our CPC brought up th e "overcollection" issue since it has bee n in the 
news. I ll am n ot supposed to use these records \ 

j I submitted another NSLto ask for me 

records again. 


The problem 1 am runnina into now - is the records are not exactly the same 

- since 1 

i 1 

i 

1 1 will charqe out 

the EC and resubmit another without 

Jso 1 can be in 

compliance with not "overcollecting." 

l/\/as not 


referenced i n any other ECs associated with m 
up in anothe l ~ 

fn any other case investigations. 


to my case based upon 


3 


case. However, it did pop 
No references were made 


The second serial I wrote has to do with[ 


I got the 


same results from the second NSL results. ! ' 

are off by 8 hours - which probably has to do with howj 
captures it - whether it is GMT or PST. I asked San Francisco to check with 
I I on the times - so I will know if the times reported in my original EC 


are correct. If they are not, I can charge out that EC and fix the times. If you 
think I should charge it anvwavs, since I wasn't supposed to have those 
records at that time - 1 can do that and resubmit another EC with the same 
information, but dated later. By the way, with the new NSL results there is 
also one mor d I that showed up ! 


] 


One of the phone companies gave me subscriber results I did not request, 
so that will be reported to the IOB. I wanted subscriber information for the 
phone number they provided, they just gave it to me for the wrong time 
period. 


Also - it appears that I got "extra" records 
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|l have been working with l l and the* 


[ ech guys to get this resol ved. Ou r CDC thinks these records 

should be sequ estered - so it is up tol fc° do this. I will let vou know 

when it is done. I 1 


I will most likely report to the IOB tha t! h ave me transactional 

records I did not request. At th e time I got them our CD C thought it would be 
good enough for i I to doc ument thal Iwillinalv provided the 

records - and that w as the end of it. I I 

| Now we are re-visiting this, I am going to double check 
with our CDC and make sure these records need to be sequestered. 


I am keeping my fingers crossed that there are no more after this... . If you 
have any questions, and I have thoroughly confused you let me know. I will 
provide you with a copy of the EC regarding the IOB violations when it is 
done 
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[has advised that after the provider was served the court orders! 
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ladvertently provideq. 


they 

Ipre-dated the court authorization period. 


Correct me If I'm wrong, but we will probably want to let the FISC know about the Provider error. 
Ve should be able to Issue an NSL to legally collect that data if necessary. 
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I just wanted to inform you about an overcollection of records | 

I am working o n getting the situation corrected at this time. Appears that I got 
“extra" recordsl I 



1 have been working with 

1 ItTaet this resolved. Our CDC thinks these 

records should be sequestered - so it is up to 
when it is done. 


to do this. 1 will let you know 
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